Admin
33bf75d245
Every project used the Postgres superuser, the RabbitMQ administrator, an admin S3 identity and the Zitadel instance-admin PAT, so any one of them could read or change the others' data. A new one-shot, `provision` (runs on every `up`, idempotent), gives each project in x-projects its own: - Postgres role, owner of its database. No database is open to PUBLIC anymore, so a role can only connect to its own. An existing database and everything in it is handed over to the project's role. - RabbitMQ user, with permissions on its own vhost only. - Zitadel service account, PROJECT_OWNER of its own project only; its PAT is written to zitadel/.output/<project>/ for that project's zitadel-init to mount instead of the admin PAT. SeaweedFS renders one S3 identity per project, limited to its bucket, and refuses to start with a clear message on a malformed or repeated key. The admin accounts stay with this stack. postgres-init is gone: provision creates the databases. *.sh files are checked out with LF so they run in the Linux containers from a Windows checkout.
61 lines
2.2 KiB
Bash
61 lines
2.2 KiB
Bash
# Production configuration for compose.yml (no overlay needed: the base
|
|
# file is already the production shape, with no published ports and
|
|
# everything reachable only on infra-net).
|
|
#
|
|
# cp .env.prod.example .env.prod
|
|
# chmod 600 .env.prod
|
|
# docker compose --env-file .env.prod -f compose.yml up -d
|
|
#
|
|
# Replace every CHANGE_ME with a strong random value (`openssl rand -hex 24`;
|
|
# the Zitadel masterkey needs exactly 32 characters) and auth.example.com
|
|
# with the real hostname the shared edge (edge/) terminates TLS for.
|
|
|
|
# --- PostgreSQL (superuser for this stack only) -----------------------------
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=CHANGE_ME
|
|
|
|
# --- Zitadel (OIDC) ----------------------------------------------------------
|
|
ZITADEL_MASTERKEY=CHANGE_ME_32_CHARACTERS_EXACTLY_
|
|
ZITADEL_EXTERNAL_DOMAIN=auth.example.com
|
|
ZITADEL_EXTERNAL_PORT=443
|
|
ZITADEL_EXTERNAL_SECURE=true
|
|
ZITADEL_TLS_MODE=external
|
|
ZITADEL_PUBLIC_SCHEME=https
|
|
# Login V2 UI, routed by the edge under the same hostname. No trailing slash.
|
|
ZITADEL_LOGIN_BASE_URL=https://auth.example.com/ui/v2/login
|
|
ZITADEL_DATABASE_PASSWORD=CHANGE_ME
|
|
ZITADEL_ORG_NAME=Iker Demo
|
|
ZITADEL_ADMIN_USERNAME=admin@ikerdemo.cat
|
|
ZITADEL_ADMIN_FIRST_NAME=Iker Demo
|
|
ZITADEL_ADMIN_LAST_NAME=Admin
|
|
ZITADEL_ADMIN_DISPLAY_NAME=Iker Demo Admin
|
|
# Must pass Zitadel's password policy (upper, lower, number, symbol, 8+).
|
|
ZITADEL_ADMIN_PASSWORD=CHANGE_ME
|
|
|
|
# --- SeaweedFS (S3; admin identity for this stack only) ---------------------
|
|
S3_ACCESS_KEY=CHANGE_ME
|
|
S3_SECRET_KEY=CHANGE_ME
|
|
|
|
# --- RabbitMQ (administrator for this stack only) ---------------------------
|
|
RABBITMQ_DEFAULT_USER=CHANGE_ME
|
|
RABBITMQ_DEFAULT_PASS=CHANGE_ME
|
|
|
|
# --- Per-project credentials (see provision/) ---------------------------------
|
|
# Each project's own .env.prod copies its values from here. S3 keys: only
|
|
# A-Z a-z 0-9 _ + / = . - (hex is fine). Empty = that project doesn't get
|
|
# that service.
|
|
MUSIFY_DB_PASSWORD=CHANGE_ME
|
|
MUSIFY_RABBITMQ_PASSWORD=CHANGE_ME
|
|
MUSIFY_S3_ACCESS_KEY=CHANGE_ME
|
|
MUSIFY_S3_SECRET_KEY=CHANGE_ME
|
|
|
|
PING_DB_PASSWORD=CHANGE_ME
|
|
PING_RABBITMQ_PASSWORD=
|
|
PING_S3_ACCESS_KEY=CHANGE_ME
|
|
PING_S3_SECRET_KEY=CHANGE_ME
|
|
|
|
DOCKERMANAGER_DB_PASSWORD=CHANGE_ME
|
|
DOCKERMANAGER_RABBITMQ_PASSWORD=
|
|
DOCKERMANAGER_S3_ACCESS_KEY=
|
|
DOCKERMANAGER_S3_SECRET_KEY=
|